Comment by lolinder

Here is a list of packages that depend on commons-text [0]. Hadoop, Spark, and Apache Commons Configuration are some of the most popular projects to depend on commons-text. Not sure if they're using the vulnerable code paths, of course.

[0] https://mvnrepository.com/artifact/org.apache.commons/common...